url remote type

This is trickier than is seems if we want to minimize
the number of downloads, and we also want this to
work with lock files.

See the updated docs for some of these difficulties.